Wearable-sensor-based HAR is a classification problem that involves data acquisition, preprocessing to filter out signal variability or noise, feature extraction, training, and validating the recognizer. Similar to other ML problems, the success of HAR largely depends on the quality and quantity of the dataset to train and develop the recognition model. While over the last decades ML-based solutions have achieved quite a success, the adversarial side of data collection for HAR is yet to be explored. To understand the magnitude of the problem, we need to look at the two modes of data collection for HAR: closed environment and mobile crowdsensing (MCS). In a closed environment, the data collection is done in a controlled way and hence the risk of adversarial attacks is close to zero. However, on the downside, this limits the variety and size of the dataset, which can cause sampling bias in the dataset. For instance, the UCI HAR dataset consists of data of 30 volunteers [1]}. Another popular HAR dataset, WISDM, was acquired from 51 test subjects [2]}. The MHealth dataset contains data from ten volunteers [3]}. Such limitation is a real hindrance to the development process of a HAR system. While MCS has the great potential to solve this problem, its openness allows malicious entities to attack the system easily. In MCS, adversaries have the privilege of sending corrupted samples directly to the dataset aggregator to poison the recognition system; and hence mislead to produce erroneous outcomes. Such an attack is referred to as a data poisoning attack. To develop a robust HAR system, it is critical to study how well a HAR system performs under poisoning attacks. In a training-only data poisoning attack, the attacker is capable of manipulating the training instances of the target model without the need of accessing the test instances. Several training-only data poisoning attacks have been proposed in literature including feature collision, influence functions, label flipping, vanishing gradients, generative models, and model poisoning[4]}. As the classifier learns from poisoned data, it will lead to unintentional or even life-threaten situations. Let us consider a HAR system designed to call for emergency service if detects a sudden fall. For fun, profit, and revenge, attackers might attempt to alter the training dataset so that the trained model on the poisoned dataset recognizes a heart attack-related fall as a regular sitting. This is an example of targeted attack in which the attacker's goal is to change the behavior of the model on particular instances. In untargeted attacks, attackers seek to alter a model's behavior regardless of particular instances or scenarios. A subclass of data poisoning attack is label flipping attack where the label of a sensor reading is maliciously changed in the data collection phase[5]}, [6]}, [7]}, [8]}. Let us consider a HAR system to recognize the following activities using a smartphone: {walking, going upstairs, going downstairs, sitting, standing, laying, crawling}. In an untargeted label flipping attack, an attacker might aim to jeopardize the model development process by injecting label flipped data as much as possible. To illustrate, instead of sending data for walking, the attacker might change the label to standing.
